Loading story…
A proof of concept is available for CVE-2026-14669, a CVSS 8.8 heap-based buffer overflow in PostgreSQL's to_char(timestamptz) date/time formatting path. Improper validation of session timezone-abbreviation length permits an authenticated attacker able to set the session timezone over a normal SQL connection to corrupt memory in the database server process, potentially causing denial of service or executing code as the operating-system account that runs PostgreSQL.
Published exploit details describe using the overflow to disclose heap and PIE-base pointers, forge a MemoryContextCallback, and invoke system during MemoryContextReset() cleanup. PostgreSQL versions 14 through 18 are affected before their respective fixed releases; organizations should identify exposed instances and promptly upgrade to the patched versions in the vendor security bulletin, particularly where untrusted users can establish SQL sessions or alter session settings.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
A proof of concept for exploiting CVE-2026-14669 became available, demonstrating the risk of exploiting the PostgreSQL timezone-formatting flaw.
A fix associated with commit 3d724bf4fde67a2931733a5143b7d6c12b23990c added a length check before copying timezone-format values and returns a DATETIME_VALUE_OUT_OF_RANGE error when the value is too long. Patched releases are PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 or later.
CVE-2026-14669 was identified as a heap-based buffer overflow in PostgreSQL's to_char(timestamptz) timezone-abbreviation handling. An attacker able to set the session timezone could corrupt server-process memory, potentially causing denial of service or code execution as the PostgreSQL operating-system user.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcecvereports.com
Open sourcesecurity.alpinelinux.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PostgreSQL has released security updates for all supported branches after fixing **28 vulnerabilities**, including several high-severity flaws that could lead to remote code execution or full compromise of database instances. Patched versions are **14.24**, **15.19**, **16.15**, **17.11**, and **18.6**. Among the most serious issues are **`CVE-2026-14662`**, an out-of-bounds write involving the `tsvector` and `tsquery` data types, and **`CVE-2026-18408`**, which can enable code execution during the database restore process. Additional high-impact bugs disclosed in the same release include **`CVE-2026-14669`**, a heap buffer overflow in `to_char(timestamptz)` triggered by long POSIX timezone abbreviations and rated **CVSS 8.8**, and **`CVE-2026-14679`**, an argument-matching flaw that permits controlled out-of-bounds writes on the stack and carries a **CVSS 8.2** score. Successful exploitation of these vulnerabilities could allow attackers to execute code as the operating-system user running PostgreSQL. PostgreSQL said it had no reports of active exploitation at publication time and also warned that support for **PostgreSQL 14** ends on **November 12, 2026**, after which it will no longer receive security fixes.
Aug 20, 2026
Researchers disclosed an **integer wraparound/overflow** flaw in PostgreSQL’s *libpq* client library (tracked as **CVE-2025-12818**) that can be triggered via the `PQescapeInternal` code path used by `PQescapeLiteral` and `PQescapeIdentifier`. When a crafted input string of certain lengths includes quotes and/or backslashes, *libpq* can miscalculate the required buffer size, allocate too little memory, and then perform an **out-of-bounds write by hundreds of megabytes**, typically resulting in a **segmentation fault (DoS)** in the consuming application. F5’s product advisories state that PostgreSQL versions prior to **18.1, 17.7, 16.11, 15.15, 14.20, and 13.23** are affected by CVE-2025-12818, but report **no impact to F5 products** after evaluation. Separate F5 advisories published alongside this disclosure cover unrelated issues, including a PostgreSQL authorization/DoS issue in `CREATE STATISTICS` (**CVE-2025-12817**), a curl cross-protocol redirect token-leak issue (**CVE-2025-14524**), an Apache Solr *create core* input-validation/allowPaths bypass with potential NTLM hash disclosure on Windows (**CVE-2026-22444**), and a local privilege-escalation issue in the Intel 800 Series Ethernet Linux driver affecting certain F5 appliance lines (**CVE-2025-24325**).
Jun 29, 2026
Microsoft disclosed two high-severity database-related vulnerabilities affecting **PgBouncer** and **PostgreSQL**, including `CVE-2026-6665`, a stack-based buffer overflow in PgBouncer's **SCRAM** authentication handling, and `CVE-2026-6637`, which affects PostgreSQL's `refint` component and can allow both a stack buffer overflow and **SQL injection**. The PgBouncer issue is classified as `CWE-121` and carries a **CVSS 8.1** score, indicating high potential impact to confidentiality, integrity, and availability. According to Microsoft's advisory, `CVE-2026-6665` is remotely reachable over the network, requires **no privileges** and **no user interaction**, though exploitation is assessed as having **high attack complexity**. The related PostgreSQL `refint` flaw broadens the risk profile by combining memory corruption with SQL injection exposure, raising concern for organizations running PostgreSQL environments directly or behind PgBouncer connection pooling layers.
Jun 29, 2026